Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc vfs updates from Al Viro:
 "All kinds of stuff.  That probably should've been 5 or 6 separate
  branches, but by the time I'd realized how large and mixed that bag
  had become it had been too close to -final to play with rebasing.

  Some fs/namei.c cleanups there, memdup_user_nul() introduction and
  switching open-coded instances, burying long-dead code, whack-a-mole
  of various kinds, several new helpers for ->llseek(), assorted
  cleanups and fixes from various people, etc.

  One piece probably deserves special mention - Neil's
  lookup_one_len_unlocked().  Similar to lookup_one_len(), but gets
  called without ->i_mutex and tries to avoid ever taking it.  That, of
  course, means that it's not useful for any directory modifications,
  but things like getting inode attributes in nfds readdirplus are fine
  with that.  I really should've asked for moratorium on lookup-related
  changes this cycle, but since I hadn't done that early enough...  I
  *am* asking for that for the coming cycle, though - I'm going to try
  and get conversion of i_mutex to rwsem with ->lookup() done under lock
  taken shared.

  There will be a patch closer to the end of the window, along the lines
  of the one Linus had posted last May - mechanical conversion of
  ->i_mutex accesses to inode_lock()/inode_unlock()/inode_trylock()/
  inode_is_locked()/inode_lock_nested().  To quote Linus back then:

    -----
    |    This is an automated patch using
    |
    |        sed 's/mutex_lock(&\(.*\)->i_mutex)/inode_lock(\1)/'
    |        sed 's/mutex_unlock(&\(.*\)->i_mutex)/inode_unlock(\1)/'
    |        sed 's/mutex_lock_nested(&\(.*\)->i_mutex,[     ]*I_MUTEX_\([A-Z0-9_]*\))/inode_lock_nested(\1, I_MUTEX_\2)/'
    |        sed 's/mutex_is_locked(&\(.*\)->i_mutex)/inode_is_locked(\1)/'
    |        sed 's/mutex_trylock(&\(.*\)->i_mutex)/inode_trylock(\1)/'
    |
    |    with a very few manual fixups
    -----

  I'm going to send that once the ->i_mutex-affecting stuff in -next
  gets mostly merged (or when Linus says he's about to stop taking
  merges)"

* 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
  nfsd: don't hold i_mutex over userspace upcalls
  fs:affs:Replace time_t with time64_t
  fs/9p: use fscache mutex rather than spinlock
  proc: add a reschedule point in proc_readfd_common()
  logfs: constify logfs_block_ops structures
  fcntl: allow to set O_DIRECT flag on pipe
  fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGE
  fs: xattr: Use kvfree()
  [s390] page_to_phys() always returns a multiple of PAGE_SIZE
  nbd: use ->compat_ioctl()
  fs: use block_device name vsprintf helper
  lib/vsprintf: add %*pg format specifier
  fs: use gendisk->disk_name where possible
  poll: plug an unused argument to do_poll
  amdkfd: don't open-code memdup_user()
  cdrom: don't open-code memdup_user()
  rsxx: don't open-code memdup_user()
  mtip32xx: don't open-code memdup_user()
  [um] mconsole: don't open-code memdup_user_nul()
  [um] hostaudio: don't open-code memdup_user()
  ...

61 files changed, 379 insertions, 384 deletions

diff --git a/fs/9p/cache.c b/fs/9p/cache.c
index a69260f27555..103ca5e1267b 100644
--- a/fs/9p/cache.c
+++ b/fs/9p/cache.c
@@ -243,14 +243,14 @@ void v9fs_cache_inode_set_cookie(struct inode *inode, struct file *filp)
         if (!v9inode->fscache)
                 return;
 
-        spin_lock(&v9inode->fscache_lock);
+        mutex_lock(&v9inode->fscache_lock);
 
         if ((filp->f_flags & O_ACCMODE) != O_RDONLY)
                 v9fs_cache_inode_flush_cookie(inode);
         else
                 v9fs_cache_inode_get_cookie(inode);
 
-        spin_unlock(&v9inode->fscache_lock);
+        mutex_unlock(&v9inode->fscache_lock);
 }
 
 void v9fs_cache_inode_reset_cookie(struct inode *inode)
@@ -264,7 +264,7 @@ void v9fs_cache_inode_reset_cookie(struct inode *inode)
 
         old = v9inode->fscache;
 
-        spin_lock(&v9inode->fscache_lock);
+        mutex_lock(&v9inode->fscache_lock);
         fscache_relinquish_cookie(v9inode->fscache, 1);
 
         v9ses = v9fs_inode2v9ses(inode);
@@ -274,7 +274,7 @@ void v9fs_cache_inode_reset_cookie(struct inode *inode)
         p9_debug(P9_DEBUG_FSC, "inode %p revalidating cookie old %p new %p\n",
                  inode, old, v9inode->fscache);
 
-        spin_unlock(&v9inode->fscache_lock);
+        mutex_unlock(&v9inode->fscache_lock);
 }
 
 int __v9fs_fscache_release_page(struct page *page, gfp_t gfp)
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index 0923f2cf3c80..6877050384a1 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -123,7 +123,7 @@ struct v9fs_session_info {
 
 struct v9fs_inode {
 #ifdef CONFIG_9P_FSCACHE
-        spinlock_t fscache_lock;
+        struct mutex fscache_lock;
         struct fscache_cookie *fscache;
 #endif
         struct p9_qid qid;
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index c7cc7c30f0c8..3a08b3e6ff1d 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -244,7 +244,7 @@ struct inode *v9fs_alloc_inode(struct super_block *sb)
                 return NULL;
 #ifdef CONFIG_9P_FSCACHE
         v9inode->fscache = NULL;
-        spin_lock_init(&v9inode->fscache_lock);
+        mutex_init(&v9inode->fscache_lock);
 #endif
         v9inode->writeback_fid = NULL;
         v9inode->cache_validity = 0;
diff --git a/fs/adfs/adfs.h b/fs/adfs/adfs.h
index 24575d9d882d..ea4aba56f29d 100644
--- a/fs/adfs/adfs.h
+++ b/fs/adfs/adfs.h
@@ -45,7 +45,7 @@ struct adfs_dir_ops;
 struct adfs_sb_info {
         union { struct {
                 struct adfs_discmap *s_map;     /* bh list containing map        */
-                struct adfs_dir_ops *s_dir;     /* directory operations          */
+                const struct adfs_dir_ops *s_dir; /* directory operations        */
                 };
                 struct rcu_head rcu;            /* used only at shutdown time    */
         };
@@ -168,8 +168,8 @@ void __adfs_error(struct super_block *sb, const char *function,
 extern const struct inode_operations adfs_dir_inode_operations;
 extern const struct file_operations adfs_dir_operations;
 extern const struct dentry_operations adfs_dentry_operations;
-extern struct adfs_dir_ops adfs_f_dir_ops;
-extern struct adfs_dir_ops adfs_fplus_dir_ops;
+extern const struct adfs_dir_ops adfs_f_dir_ops;
+extern const struct adfs_dir_ops adfs_fplus_dir_ops;
 
 extern int adfs_dir_update(struct super_block *sb, struct object_info *obj,
                            int wait);
diff --git a/fs/adfs/dir.c b/fs/adfs/dir.c
index 51c279a29845..fd4cf2c48e48 100644
--- a/fs/adfs/dir.c
+++ b/fs/adfs/dir.c
@@ -21,7 +21,7 @@ adfs_readdir(struct file *file, struct dir_context *ctx)
 {
         struct inode *inode = file_inode(file);
         struct super_block *sb = inode->i_sb;
-        struct adfs_dir_ops *ops = ADFS_SB(sb)->s_dir;
+        const struct adfs_dir_ops *ops = ADFS_SB(sb)->s_dir;
         struct object_info obj;
         struct adfs_dir dir;
         int ret = 0;
@@ -69,7 +69,7 @@ adfs_dir_update(struct super_block *sb, struct object_info *obj, int wait)
 {
         int ret = -EINVAL;
 #ifdef CONFIG_ADFS_FS_RW
-        struct adfs_dir_ops *ops = ADFS_SB(sb)->s_dir;
+        const struct adfs_dir_ops *ops = ADFS_SB(sb)->s_dir;
         struct adfs_dir dir;
 
         printk(KERN_INFO "adfs_dir_update: object %06X in dir %06X\n",
@@ -129,7 +129,7 @@ static int
 adfs_dir_lookup_byname(struct inode *inode, struct qstr *name, struct object_info *obj)
 {
         struct super_block *sb = inode->i_sb;
-        struct adfs_dir_ops *ops = ADFS_SB(sb)->s_dir;
+        const struct adfs_dir_ops *ops = ADFS_SB(sb)->s_dir;
         struct adfs_dir dir;
         int ret;
 
diff --git a/fs/adfs/dir_f.c b/fs/adfs/dir_f.c
index 4bbe853ee50a..0fbfd0b04ae0 100644
--- a/fs/adfs/dir_f.c
+++ b/fs/adfs/dir_f.c
@@ -476,7 +476,7 @@ adfs_f_free(struct adfs_dir *dir)
         dir->sb = NULL;
 }
 
-struct adfs_dir_ops adfs_f_dir_ops = {
+const struct adfs_dir_ops adfs_f_dir_ops = {
         .read           = adfs_f_read,
         .setpos         = adfs_f_setpos,
         .getnext        = adfs_f_getnext,
diff --git a/fs/adfs/dir_fplus.c b/fs/adfs/dir_fplus.c
index 82d14cdf70f9..c92cfb638c18 100644
--- a/fs/adfs/dir_fplus.c
+++ b/fs/adfs/dir_fplus.c
@@ -256,7 +256,7 @@ adfs_fplus_free(struct adfs_dir *dir)
         dir->sb = NULL;
 }
 
-struct adfs_dir_ops adfs_fplus_dir_ops = {
+const struct adfs_dir_ops adfs_fplus_dir_ops = {
         .read           = adfs_fplus_read,
         .setpos         = adfs_fplus_setpos,
         .getnext        = adfs_fplus_getnext,
diff --git a/fs/affs/affs.h b/fs/affs/affs.h
index c69a87eaf57d..cc2b2efc9211 100644
--- a/fs/affs/affs.h
+++ b/fs/affs/affs.h
@@ -138,7 +138,7 @@ extern int	affs_remove_hash(struct inode *dir, struct buffer_head *rem_bh);
 extern int      affs_remove_header(struct dentry *dentry);
 extern u32      affs_checksum_block(struct super_block *sb, struct buffer_head *bh);
 extern void     affs_fix_checksum(struct super_block *sb, struct buffer_head *bh);
-extern void     secs_to_datestamp(time_t secs, struct affs_date *ds);
+extern void     secs_to_datestamp(time64_t secs, struct affs_date *ds);
 extern umode_t  prot_to_mode(u32 prot);
 extern void     mode_to_prot(struct inode *inode);
 __printf(3, 4)
diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
index 5fa92bc790ef..d6c7a51c93e4 100644
--- a/fs/affs/amigaffs.c
+++ b/fs/affs/amigaffs.c
@@ -8,6 +8,7 @@
  *  Please send bug reports to: hjw@zvw.de
  */
 
+#include <linux/math64.h>
 #include "affs.h"
 
 /*
@@ -366,22 +367,22 @@ affs_fix_checksum(struct super_block *sb, struct buffer_head *bh)
 }
 
 void
-secs_to_datestamp(time_t secs, struct affs_date *ds)
+secs_to_datestamp(time64_t secs, struct affs_date *ds)
 {
         u32      days;
         u32      minute;
+        s32      rem;
 
         secs -= sys_tz.tz_minuteswest * 60 + ((8 * 365 + 2) * 24 * 60 * 60);
         if (secs < 0)
                 secs = 0;
-        days    = secs / 86400;
-        secs   -= days * 86400;
-        minute  = secs / 60;
-        secs   -= minute * 60;
+        days    = div_s64_rem(secs, 86400, &rem);
+        minute  = rem / 60;
+        rem    -= minute * 60;
 
         ds->days = cpu_to_be32(days);
         ds->mins = cpu_to_be32(minute);
-        ds->ticks = cpu_to_be32(secs * 50);
+        ds->ticks = cpu_to_be32(rem * 50);
 }
 
 umode_t
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 5b50c4ca43a7..8836df5f1e11 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -32,7 +32,7 @@ affs_commit_super(struct super_block *sb, int wait)
         struct affs_root_tail *tail = AFFS_ROOT_TAIL(sb, bh);
 
         lock_buffer(bh);
-        secs_to_datestamp(get_seconds(), &tail->disk_change);
+        secs_to_datestamp(ktime_get_real_seconds(), &tail->disk_change);
         affs_fix_checksum(sb, bh);
         unlock_buffer(bh);
 
diff --git a/fs/afs/proc.c b/fs/afs/proc.c
index 24a905b076fd..2853b4095344 100644
--- a/fs/afs/proc.c
+++ b/fs/afs/proc.c
@@ -230,14 +230,9 @@ static ssize_t afs_proc_cells_write(struct file *file, const char __user *buf,
         if (size <= 1 || size >= PAGE_SIZE)
                 return -EINVAL;
 
-        kbuf = kmalloc(size + 1, GFP_KERNEL);
-        if (!kbuf)
-                return -ENOMEM;
-
-        ret = -EFAULT;
-        if (copy_from_user(kbuf, buf, size) != 0)
-                goto done;
-        kbuf[size] = 0;
+        kbuf = memdup_user_nul(buf, size);
+        if (IS_ERR(kbuf))
+                return PTR_ERR(kbuf);
 
         /* trim to first NL */
         name = memchr(kbuf, '\n', size);
@@ -315,15 +310,9 @@ static ssize_t afs_proc_rootcell_write(struct file *file,
         if (size <= 1 || size >= PAGE_SIZE)
                 return -EINVAL;
 
-        ret = -ENOMEM;
-        kbuf = kmalloc(size + 1, GFP_KERNEL);
-        if (!kbuf)
-                goto nomem;
-
-        ret = -EFAULT;
-        if (copy_from_user(kbuf, buf, size) != 0)
-                goto infault;
-        kbuf[size] = 0;
+        kbuf = memdup_user_nul(buf, size);
+        if (IS_ERR(kbuf))
+                return PTR_ERR(kbuf);
 
         /* trim to first NL */
         s = memchr(kbuf, '\n', size);
@@ -337,9 +326,7 @@ static ssize_t afs_proc_rootcell_write(struct file *file,
         if (ret >= 0)
                 ret = size;     /* consume everything, always */
 
-infault:
         kfree(kbuf);
-nomem:
         _leave(" = %d", ret);
         return ret;
 }
diff --git a/fs/bad_inode.c b/fs/bad_inode.c
index 861b1e1c4777..103f5d7c3083 100644
--- a/fs/bad_inode.c
+++ b/fs/bad_inode.c
@@ -192,7 +192,7 @@ EXPORT_SYMBOL(make_bad_inode);
  *      Returns true if the inode in question has been marked as bad.
  */
  
-int is_bad_inode(struct inode *inode)
+bool is_bad_inode(struct inode *inode)
 {
         return (inode->i_op == &bad_inode_ops); 
 }
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 44d4a1e9244e..01b8e0d4b4ff 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1042,12 +1042,9 @@ EXPORT_SYMBOL_GPL(bd_unlink_disk_holder);
 static void flush_disk(struct block_device *bdev, bool kill_dirty)
 {
         if (__invalidate_device(bdev, kill_dirty)) {
-                char name[BDEVNAME_SIZE] = "";
-
-                if (bdev->bd_disk)
-                        disk_name(bdev->bd_disk, 0, name);
                 printk(KERN_WARNING "VFS: busy inodes on changed media or "
-                       "resized disk %s\n", name);
+                       "resized disk %s\n",
+                       bdev->bd_disk ? bdev->bd_disk->disk_name : "");
         }
 
         if (!bdev->bd_disk)
@@ -1071,12 +1068,9 @@ void check_disk_size_change(struct gendisk *disk, struct block_device *bdev)
         disk_size = (loff_t)get_capacity(disk) << 9;
         bdev_size = i_size_read(bdev->bd_inode);
         if (disk_size != bdev_size) {
-                char name[BDEVNAME_SIZE];
-
-                disk_name(disk, 0, name);
                 printk(KERN_INFO
                        "%s: detected capacity change from %lld to %lld\n",
-                       name, bdev_size, disk_size);
+                       disk->disk_name, bdev_size, disk_size);
                 i_size_write(bdev->bd_inode, disk_size);
                 flush_disk(bdev, false);
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 24154e422945..a0434c179ea9 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1514,9 +1514,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                 if ((flags ^ s->s_flags) & MS_RDONLY)
                         error = -EBUSY;
         } else {
-                char b[BDEVNAME_SIZE];
-
-                strlcpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
+                snprintf(s->s_id, sizeof(s->s_id), "%pg", bdev);
                 btrfs_sb(s)->bdev_holder = fs_type;
                 error = btrfs_fill_super(s, fs_devices, data,
                                          flags & MS_SILENT ? 1 : 0);
diff --git a/fs/buffer.c b/fs/buffer.c
index 4f4cd959da7c..e1632abb4ca9 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -134,13 +134,10 @@ __clear_page_buffers(struct page *page)
 
 static void buffer_io_error(struct buffer_head *bh, char *msg)
 {
-        char b[BDEVNAME_SIZE];
-
         if (!test_bit(BH_Quiet, &bh->b_state))
                 printk_ratelimited(KERN_ERR
-                        "Buffer I/O error on dev %s, logical block %llu%s\n",
-                        bdevname(bh->b_bdev, b),
-                        (unsigned long long)bh->b_blocknr, msg);
+                        "Buffer I/O error on dev %pg, logical block %llu%s\n",
+                        bh->b_bdev, (unsigned long long)bh->b_blocknr, msg);
 }
 
 /*
@@ -237,15 +234,13 @@ __find_get_block_slow(struct block_device *bdev, sector_t block)
          * elsewhere, don't buffer_error if we had some unmapped buffers
          */
         if (all_mapped) {
-                char b[BDEVNAME_SIZE];
-
                 printk("__find_get_block_slow() failed. "
                         "block=%llu, b_blocknr=%llu\n",
                         (unsigned long long)block,
                         (unsigned long long)bh->b_blocknr);
                 printk("b_state=0x%08lx, b_size=%zu\n",
                         bh->b_state, bh->b_size);
-                printk("device %s blocksize: %d\n", bdevname(bdev, b),
+                printk("device %pg blocksize: %d\n", bdev,
                         1 << bd_inode->i_blkbits);
         }
 out_unlock:
@@ -531,10 +526,8 @@ repeat:
 
 static void do_thaw_one(struct super_block *sb, void *unused)
 {
-        char b[BDEVNAME_SIZE];
         while (sb->s_bdev && !thaw_bdev(sb->s_bdev, sb))
-                printk(KERN_WARNING "Emergency Thaw on %s\n",
-                       bdevname(sb->s_bdev, b));
+                printk(KERN_WARNING "Emergency Thaw on %pg\n", sb->s_bdev);
 }
 
 static void do_thaw_all(struct work_struct *work)
@@ -1074,12 +1067,10 @@ grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp)
          * pagecache index.  (this comparison is done using sector_t types).
          */
         if (unlikely(index != block >> sizebits)) {
-                char b[BDEVNAME_SIZE];
-
                 printk(KERN_ERR "%s: requested out-of-range block %llu for "
-                        "device %s\n",
+                        "device %pg\n",
                         __func__, (unsigned long long)block,
-                        bdevname(bdev, b));
+                        bdev);
                 return -EIO;
         }
 
diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
index f601def05bdf..452e98dd7560 100644
--- a/fs/cachefiles/daemon.c
+++ b/fs/cachefiles/daemon.c
@@ -226,15 +226,9 @@ static ssize_t cachefiles_daemon_write(struct file *file,
                 return -EOPNOTSUPP;
 
         /* drag the command string into the kernel so we can parse it */
-        data = kmalloc(datalen + 1, GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        ret = -EFAULT;
-        if (copy_from_user(data, _data, datalen) != 0)
-                goto error;
-
-        data[datalen] = '\0';
+        data = memdup_user_nul(_data, datalen);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
 
         ret = -EINVAL;
         if (memchr(data, '\0', datalen))
diff --git a/fs/compat.c b/fs/compat.c
index 6fd272d455e4..a71936a3f4cb 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -792,7 +792,7 @@ COMPAT_SYSCALL_DEFINE5(mount, const char __user *, dev_name,
                        const void __user *, data)
 {
         char *kernel_type;
-        unsigned long data_page;
+        void *options;
         char *kernel_dev;
         int retval;
 
@@ -806,26 +806,25 @@ COMPAT_SYSCALL_DEFINE5(mount, const char __user *, dev_name,
         if (IS_ERR(kernel_dev))
                 goto out1;
 
-        retval = copy_mount_options(data, &data_page);
-        if (retval < 0)
+        options = copy_mount_options(data);
+        retval = PTR_ERR(options);
+        if (IS_ERR(options))
                 goto out2;
 
-        retval = -EINVAL;
-
-        if (kernel_type && data_page) {
+        if (kernel_type && options) {
                 if (!strcmp(kernel_type, NCPFS_NAME)) {
-                        do_ncp_super_data_conv((void *)data_page);
+                        do_ncp_super_data_conv(options);
                 } else if (!strcmp(kernel_type, NFS4_NAME)) {
-                        if (do_nfs4_super_data_conv((void *) data_page))
+                        retval = -EINVAL;
+                        if (do_nfs4_super_data_conv(options))
                                 goto out3;
                 }
         }
 
-        retval = do_mount(kernel_dev, dir_name, kernel_type,
-                        flags, (void*)data_page);
+        retval = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
 
  out3:
-        free_page(data_page);
+        kfree(options);
  out2:
         kfree(kernel_dev);
  out1:
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 647ee0b03dc0..a5b8eb69a8f4 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1305,12 +1305,6 @@ COMPATIBLE_IOCTL(PCIIOC_CONTROLLER)
 COMPATIBLE_IOCTL(PCIIOC_MMAP_IS_IO)
 COMPATIBLE_IOCTL(PCIIOC_MMAP_IS_MEM)
 COMPATIBLE_IOCTL(PCIIOC_WRITE_COMBINE)
-/* NBD */
-COMPATIBLE_IOCTL(NBD_DO_IT)
-COMPATIBLE_IOCTL(NBD_CLEAR_SOCK)
-COMPATIBLE_IOCTL(NBD_CLEAR_QUE)
-COMPATIBLE_IOCTL(NBD_PRINT_DEBUG)
-COMPATIBLE_IOCTL(NBD_DISCONNECT)
 /* i2c */
 COMPATIBLE_IOCTL(I2C_SLAVE)
 COMPATIBLE_IOCTL(I2C_SLAVE_FORCE)
@@ -1529,11 +1523,6 @@ static long do_ioctl_trans(unsigned int cmd,
         case KDSKBMETA:
         case KDSKBLED:
         case KDSETLED:
-        /* NBD */
-        case NBD_SET_SOCK:
-        case NBD_SET_BLKSIZE:
-        case NBD_SET_SIZE:
-        case NBD_SET_SIZE_BLOCKS:
                 return vfs_ioctl(file, cmd, arg);
         }
 
diff --git a/fs/coredump.c b/fs/coredump.c
index 1777331eee76..b3c153ca435d 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -32,6 +32,7 @@
 #include <linux/pipe_fs_i.h>
 #include <linux/oom.h>
 #include <linux/compat.h>
+#include <linux/timekeeping.h>
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
@@ -232,9 +233,10 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm)
                                 break;
                         /* UNIX time of coredump */
                         case 't': {
-                                struct timeval tv;
-                                do_gettimeofday(&tv);
-                                err = cn_printf(cn, "%lu", tv.tv_sec);
+                                time64_t time;
+
+                                time = ktime_get_real_seconds();
+                                err = cn_printf(cn, "%lld", time);
                                 break;
                         }
                         /* hostname */
diff --git a/fs/dcache.c b/fs/dcache.c
index d27f0909d9f6..8d38cd07b207 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3303,18 +3303,18 @@ out:
  * @new_dentry: new dentry
  * @old_dentry: old dentry
  *
- * Returns 1 if new_dentry is a subdirectory of the parent (at any depth).
- * Returns 0 otherwise.
+ * Returns true if new_dentry is a subdirectory of the parent (at any depth).
+ * Returns false otherwise.
  * Caller must ensure that "new_dentry" is pinned before calling is_subdir()
  */
   
-int is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
+bool is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
 {
-        int result;
+        bool result;
         unsigned seq;
 
         if (new_dentry == old_dentry)
-                return 1;
+                return true;
 
         do {
                 /* for restarting inner loop in case of seq retry */
@@ -3325,9 +3325,9 @@ int is_subdir(struct dentry *new_dentry, struct dentry *old_dentry)
                  */
                 rcu_read_lock();
                 if (d_ancestor(old_dentry, new_dentry))
-                        result = 1;
+                        result = true;
                 else
-                        result = 0;
+                        result = false;
                 rcu_read_unlock();
         } while (read_seqretry(&rename_lock, seq));
 
diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 173b3873a4f4..1925d6d222b8 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -515,14 +515,9 @@ static ssize_t device_write(struct file *file, const char __user *buf,
         if (count > sizeof(struct dlm_write_request) + DLM_RESNAME_MAXLEN)
                 return -EINVAL;
 
-        kbuf = kzalloc(count + 1, GFP_NOFS);
-        if (!kbuf)
-                return -ENOMEM;
-
-        if (copy_from_user(kbuf, buf, count)) {
-                error = -EFAULT;
-                goto out_free;
-        }
+        kbuf = memdup_user_nul(buf, count);
+        if (!IS_ERR(kbuf))
+                return PTR_ERR(kbuf);
 
         if (check_version(kbuf)) {
                 error = -EBADE;
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index a4dddc61594c..040aa879d634 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -282,9 +282,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
         if (rc) {
                 ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
                                    ecryptfs_inode);
-                make_bad_inode(ecryptfs_inode);
-                unlock_new_inode(ecryptfs_inode);
-                iput(ecryptfs_inode);
+                iget_failed(ecryptfs_inode);
                 goto out;
         }
         unlock_new_inode(ecryptfs_inode);
diff --git a/fs/exec.c b/fs/exec.c
index b06623a9347f..828ec5f07de0 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -119,7 +119,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
         int error = PTR_ERR(tmp);
         static const struct open_flags uselib_flags = {
                 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
-                .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
+                .acc_mode = MAY_READ | MAY_EXEC,
                 .intent = LOOKUP_OPEN,
                 .lookup_flags = LOOKUP_FOLLOW,
         };
@@ -763,7 +763,7 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags)
         int err;
         struct open_flags open_exec_flags = {
                 .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
-                .acc_mode = MAY_EXEC | MAY_OPEN,
+                .acc_mode = MAY_EXEC,
                 .intent = LOOKUP_OPEN,
                 .lookup_flags = LOOKUP_FOLLOW,
         };
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index cd95d14f9cc2..f57a7aba32eb 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -77,10 +77,8 @@
                 printk("\n"); \
         } while (0)
 # define ea_bdebug(bh, f...) do { \
-                char b[BDEVNAME_SIZE]; \
-                printk(KERN_DEBUG "block %s:%lu: ", \
-                        bdevname(bh->b_bdev, b), \
-                        (unsigned long) bh->b_blocknr); \
+                printk(KERN_DEBUG "block %pg:%lu: ", \
+                        bh->b_bdev, (unsigned long) bh->b_blocknr); \
                 printk(f); \
                 printk("\n"); \
         } while (0)
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index 17fbe3882b8e..090b3498638e 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -52,9 +52,8 @@ void ext4_exit_pageio(void)
  */
 static void buffer_io_error(struct buffer_head *bh)
 {
-        char b[BDEVNAME_SIZE];
-        printk_ratelimited(KERN_ERR "Buffer I/O error on device %s, logical block %llu\n",
-                        bdevname(bh->b_bdev, b),
+        printk_ratelimited(KERN_ERR "Buffer I/O error on device %pg, logical block %llu\n",
+                       bh->b_bdev,
                         (unsigned long long)bh->b_blocknr);
 }
 
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index e9b9afdd1d96..a95151e875bd 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -68,10 +68,8 @@
                 printk("\n"); \
         } while (0)
 # define ea_bdebug(bh, f...) do { \
-                char b[BDEVNAME_SIZE]; \
-                printk(KERN_DEBUG "block %s:%lu: ", \
-                        bdevname(bh->b_bdev, b), \
-                        (unsigned long) bh->b_blocknr); \
+                printk(KERN_DEBUG "block %pg:%lu: ",               \
+                       bh->b_bdev, (unsigned long) bh->b_blocknr); \
                 printk(f); \
                 printk("\n"); \
         } while (0)
diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
index 478e5d54154f..ad1b18a7705b 100644
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -211,12 +211,10 @@ static int stat_show(struct seq_file *s, void *v)
 
         mutex_lock(&f2fs_stat_mutex);
         list_for_each_entry(si, &f2fs_stat_list, stat_list) {
-                char devname[BDEVNAME_SIZE];
-
                 update_general_status(si->sbi);
 
-                seq_printf(s, "\n=====[ partition info(%s). #%d ]=====\n",
-                        bdevname(si->sbi->sb->s_bdev, devname), i++);
+                seq_printf(s, "\n=====[ partition info(%pg). #%d ]=====\n",
+                        si->sbi->sb->s_bdev, i++);
                 seq_printf(s, "[SB: 1] [CP: 2] [SIT: %d] [NAT: %d] ",
                            si->sit_area_segs, si->nat_area_segs);
                 seq_printf(s, "[SSA: %d] [MAIN: %d",
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 9db5500d63d9..ec6067c33a3f 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1602,13 +1602,11 @@ static inline bool is_dot_dotdot(const struct qstr *str)
 
 static inline bool f2fs_may_extent_tree(struct inode *inode)
 {
-        mode_t mode = inode->i_mode;
-
         if (!test_opt(F2FS_I_SB(inode), EXTENT_CACHE) ||
                         is_inode_flag_set(F2FS_I(inode), FI_NO_EXTENT))
                 return false;
 
-        return S_ISREG(mode);
+        return S_ISREG(inode->i_mode);
 }
 
 static inline void *f2fs_kvmalloc(size_t size, gfp_t flags)
@@ -2121,7 +2119,7 @@ static inline int f2fs_sb_has_crypto(struct super_block *sb)
 static inline bool f2fs_may_encrypt(struct inode *inode)
 {
 #ifdef CONFIG_F2FS_FS_ENCRYPTION
-        mode_t mode = inode->i_mode;
+        umode_t mode = inode->i_mode;
 
         return (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode));
 #else
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ee85cd4e136a..350a2c8cfd28 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -51,7 +51,8 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
                if (arg & O_NDELAY)
                    arg |= O_NONBLOCK;
 
-        if (arg & O_DIRECT) {
+        /* Pipe packetized mode is controlled by O_DIRECT flag */
+        if (!S_ISFIFO(filp->f_inode->i_mode) && (arg & O_DIRECT)) {
                 if (!filp->f_mapping || !filp->f_mapping->a_ops ||
                         !filp->f_mapping->a_ops->direct_IO)
                                 return -EINVAL;
diff --git a/fs/file.c b/fs/file.c
index 39f8f15921da..1aed0add16a2 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -25,9 +25,9 @@
 
 int sysctl_nr_open __read_mostly = 1024*1024;
 int sysctl_nr_open_min = BITS_PER_LONG;
-/* our max() is unusable in constant expressions ;-/ */
-#define __const_max(x, y) ((x) < (y) ? (x) : (y))
-int sysctl_nr_open_max = __const_max(INT_MAX, ~(size_t)0/sizeof(void *)) &
+/* our min() is unusable in constant expressions ;-/ */
+#define __const_min(x, y) ((x) < (y) ? (x) : (y))
+int sysctl_nr_open_max = __const_min(INT_MAX, ~(size_t)0/sizeof(void *)) &
                          -BITS_PER_LONG;
 
 static void *alloc_fdmem(size_t size)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index baab99b69d8a..001c66641243 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1315,9 +1315,7 @@ static struct dentry *gfs2_mount(struct file_system_type *fs_type, int flags,
                 if ((flags ^ s->s_flags) & MS_RDONLY)
                         goto error_super;
         } else {
-                char b[BDEVNAME_SIZE];
-
-                strlcpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
+                snprintf(s->s_id, sizeof(s->s_id), "%pg", bdev);
                 sb_set_blocksize(s, block_size(bdev));
                 error = fill_super(s, &args, flags & MS_SILENT ? 1 : 0);
                 if (error)
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index aa3f0d6d043c..a3ec3ae7d347 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -166,7 +166,7 @@ int hfs_mdb_get(struct super_block *sb)
                 pr_warn("continuing without an alternate MDB\n");
         }
 
-        HFS_SB(sb)->bitmap = (__be32 *)__get_free_pages(GFP_KERNEL, PAGE_SIZE < 8192 ? 1 : 0);
+        HFS_SB(sb)->bitmap = kmalloc(8192, GFP_KERNEL);
         if (!HFS_SB(sb)->bitmap)
                 goto out;
 
@@ -360,7 +360,7 @@ void hfs_mdb_put(struct super_block *sb)
         unload_nls(HFS_SB(sb)->nls_io);
         unload_nls(HFS_SB(sb)->nls_disk);
 
-        free_pages((unsigned long)HFS_SB(sb)->bitmap, PAGE_SIZE < 8192 ? 1 : 0);
+        kfree(HFS_SB(sb)->bitmap);
         kfree(HFS_SB(sb));
         sb->s_fs_info = NULL;
 }
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index a69bbc1e87f8..a136929189f0 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -133,7 +133,7 @@ __le32 *hpfs_load_bitmap_directory(struct super_block *s, secno bmp)
 void hpfs_load_hotfix_map(struct super_block *s, struct hpfs_spare_block *spareblock)
 {
         struct quad_buffer_head qbh;
-        u32 *directory;
+        __le32 *directory;
         u32 n_hotfixes, n_used_hotfixes;
         unsigned i;
 
diff --git a/fs/internal.h b/fs/internal.h
index e38c08ca437d..b71deeecea17 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -55,7 +55,7 @@ extern int vfs_path_lookup(struct dentry *, struct vfsmount *,
 /*
  * namespace.c
  */
-extern int copy_mount_options(const void __user *, unsigned long *);
+extern void *copy_mount_options(const void __user *);
 extern char *copy_mount_string(const void __user *);
 
 extern struct vfsmount *lookup_mnt(struct path *);
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index ca181e81c765..081dff087fc0 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -764,13 +764,11 @@ void jbd2_journal_unlock_updates (journal_t *journal)
 
 static void warn_dirty_buffer(struct buffer_head *bh)
 {
-        char b[BDEVNAME_SIZE];
-
         printk(KERN_WARNING
-               "JBD2: Spotted dirty metadata buffer (dev = %s, blocknr = %llu). "
+               "JBD2: Spotted dirty metadata buffer (dev = %pg, blocknr = %llu). "
                "There's a risk of filesystem corruption in case of system "
                "crash.\n",
-               bdevname(bh->b_bdev, b), (unsigned long long)bh->b_blocknr);
+               bh->b_bdev, (unsigned long long)bh->b_blocknr);
 }
 
 /* Call t_frozen trigger and copy buffer data into jh->b_frozen_data. */
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index a69bdf2a1085..a270cb7ff4e0 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1835,17 +1835,16 @@ static int lbmLogInit(struct jfs_log * log)
         for (i = 0; i < LOGPAGES;) {
                 char *buffer;
                 uint offset;
-                struct page *page;
+                struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
 
-                buffer = (char *) get_zeroed_page(GFP_KERNEL);
-                if (buffer == NULL)
+                if (!page)
                         goto error;
-                page = virt_to_page(buffer);
+                buffer = page_address(page);
                 for (offset = 0; offset < PAGE_SIZE; offset += LOGPSIZE) {
                         lbuf = kmalloc(sizeof(struct lbuf), GFP_KERNEL);
                         if (lbuf == NULL) {
                                 if (offset == 0)
-                                        free_page((unsigned long) buffer);
+                                        __free_page(page);
                                 goto error;
                         }
                         if (offset) /* we already have one reference */
diff --git a/fs/logfs/logfs.h b/fs/logfs/logfs.h
index 209a26d84c38..39d91f86cd35 100644
--- a/fs/logfs/logfs.h
+++ b/fs/logfs/logfs.h
@@ -302,7 +302,7 @@ struct logfs_block {
         struct inode *inode;
         struct logfs_transaction *ta;
         unsigned long alias_map[LOGFS_BLOCK_FACTOR / BITS_PER_LONG];
-        struct logfs_block_ops *ops;
+        const struct logfs_block_ops *ops;
         int full;
         int partial;
         int reserved_bytes;
@@ -578,7 +578,7 @@ int logfs_exist_block(struct inode *inode, u64 bix);
 int get_page_reserve(struct inode *inode, struct page *page);
 void logfs_get_wblocks(struct super_block *sb, struct page *page, int lock);
 void logfs_put_wblocks(struct super_block *sb, struct page *page, int lock);
-extern struct logfs_block_ops indirect_block_ops;
+extern const struct logfs_block_ops indirect_block_ops;
 
 /* segment.c */
 int logfs_erase_segment(struct super_block *sb, u32 ofs, int ensure_erase);
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
index 380d86e1ab45..20973c9e52f8 100644
--- a/fs/logfs/readwrite.c
+++ b/fs/logfs/readwrite.c
@@ -569,13 +569,13 @@ static void indirect_free_block(struct super_block *sb,
 }
 
 
-static struct logfs_block_ops inode_block_ops = {
+static const struct logfs_block_ops inode_block_ops = {
         .write_block = inode_write_block,
         .free_block = inode_free_block,
         .write_alias = inode_write_alias,
 };
 
-struct logfs_block_ops indirect_block_ops = {
+const struct logfs_block_ops indirect_block_ops = {
         .write_block = indirect_write_block,
         .free_block = indirect_free_block,
         .write_alias = indirect_write_alias,
diff --git a/fs/logfs/segment.c b/fs/logfs/segment.c
index 6de0fbfc6c00..d270e4b2ab6b 100644
--- a/fs/logfs/segment.c
+++ b/fs/logfs/segment.c
@@ -197,7 +197,7 @@ static int btree_write_alias(struct super_block *sb, struct logfs_block *block,
         return 0;
 }
 
-static struct logfs_block_ops btree_block_ops = {
+static const struct logfs_block_ops btree_block_ops = {
         .write_block    = btree_write_block,
         .free_block     = __free_block,
         .write_alias    = btree_write_alias,
diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
index 282e15ad8cd8..46ca39d6c735 100644
--- a/fs/minix/itree_v1.c
+++ b/fs/minix/itree_v1.c
@@ -24,16 +24,15 @@ static inline block_t *i_data(struct inode *inode)
 static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
 {
         int n = 0;
-        char b[BDEVNAME_SIZE];
 
         if (block < 0) {
-                printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
-                        block, bdevname(inode->i_sb->s_bdev, b));
+                printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+                        block, inode->i_sb->s_bdev);
         } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
                 if (printk_ratelimit())
                         printk("MINIX-fs: block_to_path: "
-                               "block %ld too big on dev %s\n",
-                                block, bdevname(inode->i_sb->s_bdev, b));
+                               "block %ld too big on dev %pg\n",
+                                block, inode->i_sb->s_bdev);
         } else if (block < 7) {
                 offsets[n++] = block;
         } else if ((block -= 7) < 512) {
diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
index 78e2d93e5c83..1ee101352586 100644
--- a/fs/minix/itree_v2.c
+++ b/fs/minix/itree_v2.c
@@ -26,18 +26,17 @@ static inline block_t *i_data(struct inode *inode)
 static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
 {
         int n = 0;
-        char b[BDEVNAME_SIZE];
         struct super_block *sb = inode->i_sb;
 
         if (block < 0) {
-                printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
-                        block, bdevname(sb->s_bdev, b));
+                printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+                        block, sb->s_bdev);
         } else if ((u64)block * (u64)sb->s_blocksize >=
                         minix_sb(sb)->s_max_size) {
                 if (printk_ratelimit())
                         printk("MINIX-fs: block_to_path: "
-                               "block %ld too big on dev %s\n",
-                                block, bdevname(sb->s_bdev, b));
+                               "block %ld too big on dev %pg\n",
+                                block, sb->s_bdev);
         } else if (block < DIRCOUNT) {
                 offsets[n++] = block;
         } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) {
diff --git a/fs/namei.c b/fs/namei.c
index 3c909aebef70..bceefd5588a2 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -534,10 +534,8 @@ static void restore_nameidata(void)
         current->nameidata = old;
         if (old)
                 old->total_link_count = now->total_link_count;
-        if (now->stack != now->internal) {
+        if (now->stack != now->internal)
                 kfree(now->stack);
-                now->stack = now->internal;
-        }
 }
 
 static int __nd_alloc_stack(struct nameidata *nd)
@@ -654,7 +652,7 @@ static bool legitimize_links(struct nameidata *nd)
  * Path walking has 2 modes, rcu-walk and ref-walk (see
  * Documentation/filesystems/path-lookup.txt).  In situations when we can't
  * continue in RCU mode, we attempt to drop out of rcu-walk mode and grab
- * normal reference counts on dentries and vfsmounts to transition to rcu-walk
+ * normal reference counts on dentries and vfsmounts to transition to ref-walk
  * mode.  Refcounts are grabbed at the last known good point before rcu-walk
  * got stuck, so ref-walk may continue from there. If this is not successful
  * (eg. a seqcount has changed), then failure is returned and it's up to caller
@@ -804,19 +802,19 @@ static int complete_walk(struct nameidata *nd)
 
 static void set_root(struct nameidata *nd)
 {
-        get_fs_root(current->fs, &nd->root);
-}
-
-static void set_root_rcu(struct nameidata *nd)
-{
         struct fs_struct *fs = current->fs;
-        unsigned seq;
 
-        do {
-                seq = read_seqcount_begin(&fs->seq);
-                nd->root = fs->root;
-                nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
-        } while (read_seqcount_retry(&fs->seq, seq));
+        if (nd->flags & LOOKUP_RCU) {
+                unsigned seq;
+
+                do {
+                        seq = read_seqcount_begin(&fs->seq);
+                        nd->root = fs->root;
+                        nd->root_seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
+                } while (read_seqcount_retry(&fs->seq, seq));
+        } else {
+                get_fs_root(fs, &nd->root);
+        }
 }
 
 static void path_put_conditional(struct path *path, struct nameidata *nd)
@@ -838,6 +836,26 @@ static inline void path_to_nameidata(const struct path *path,
         nd->path.dentry = path->dentry;
 }
 
+static int nd_jump_root(struct nameidata *nd)
+{
+        if (nd->flags & LOOKUP_RCU) {
+                struct dentry *d;
+                nd->path = nd->root;
+                d = nd->path.dentry;
+                nd->inode = d->d_inode;
+                nd->seq = nd->root_seq;
+                if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
+                        return -ECHILD;
+        } else {
+                path_put(&nd->path);
+                nd->path = nd->root;
+                path_get(&nd->path);
+                nd->inode = nd->path.dentry->d_inode;
+        }
+        nd->flags |= LOOKUP_JUMPED;
+        return 0;
+}
+
 /*
  * Helper to directly jump to a known parsed path from ->get_link,
  * caller must have taken a reference to path beforehand.
@@ -1016,25 +1034,10 @@ const char *get_link(struct nameidata *nd)
                         return res;
         }
         if (*res == '/') {
-                if (nd->flags & LOOKUP_RCU) {
-                        struct dentry *d;
-                        if (!nd->root.mnt)
-                                set_root_rcu(nd);
-                        nd->path = nd->root;
-                        d = nd->path.dentry;
-                        nd->inode = d->d_inode;
-                        nd->seq = nd->root_seq;
-                        if (unlikely(read_seqcount_retry(&d->d_seq, nd->seq)))
-                                return ERR_PTR(-ECHILD);
-                } else {
-                        if (!nd->root.mnt)
-                                set_root(nd);
-                        path_put(&nd->path);
-                        nd->path = nd->root;
-                        path_get(&nd->root);
-                        nd->inode = nd->path.dentry->d_inode;
-                }
-                nd->flags |= LOOKUP_JUMPED;
+                if (!nd->root.mnt)
+                        set_root(nd);
+                if (unlikely(nd_jump_root(nd)))
+                        return ERR_PTR(-ECHILD);
                 while (unlikely(*++res == '/'))
                         ;
         }
@@ -1295,8 +1298,6 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
 static int follow_dotdot_rcu(struct nameidata *nd)
 {
         struct inode *inode = nd->inode;
-        if (!nd->root.mnt)
-                set_root_rcu(nd);
 
         while (1) {
                 if (path_equal(&nd->path, &nd->root))
@@ -1416,9 +1417,6 @@ static void follow_mount(struct path *path)
 
 static int follow_dotdot(struct nameidata *nd)
 {
-        if (!nd->root.mnt)
-                set_root(nd);
-
         while(1) {
                 struct dentry *old = nd->path.dentry;
 
@@ -1656,6 +1654,8 @@ static inline int may_lookup(struct nameidata *nd)
 static inline int handle_dots(struct nameidata *nd, int type)
 {
         if (type == LAST_DOTDOT) {
+                if (!nd->root.mnt)
+                        set_root(nd);
                 if (nd->flags & LOOKUP_RCU) {
                         return follow_dotdot_rcu(nd);
                 } else
@@ -2021,18 +2021,19 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
         }
 
         nd->root.mnt = NULL;
+        nd->path.mnt = NULL;
+        nd->path.dentry = NULL;
 
         nd->m_seq = read_seqbegin(&mount_lock);
         if (*s == '/') {
-                if (flags & LOOKUP_RCU) {
+                if (flags & LOOKUP_RCU)
                         rcu_read_lock();
-                        set_root_rcu(nd);
-                        nd->seq = nd->root_seq;
-                } else {
-                        set_root(nd);
-                        path_get(&nd->root);
-                }
-                nd->path = nd->root;
+                set_root(nd);
+                if (likely(!nd_jump_root(nd)))
+                        return s;
+                nd->root.mnt = NULL;
+                rcu_read_unlock();
+                return ERR_PTR(-ECHILD);
         } else if (nd->dfd == AT_FDCWD) {
                 if (flags & LOOKUP_RCU) {
                         struct fs_struct *fs = current->fs;
@@ -2043,11 +2044,14 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
                         do {
                                 seq = read_seqcount_begin(&fs->seq);
                                 nd->path = fs->pwd;
+                                nd->inode = nd->path.dentry->d_inode;
                                 nd->seq = __read_seqcount_begin(&nd->path.dentry->d_seq);
                         } while (read_seqcount_retry(&fs->seq, seq));
                 } else {
                         get_fs_pwd(current->fs, &nd->path);
+                        nd->inode = nd->path.dentry->d_inode;
                 }
+                return s;
         } else {
                 /* Caller must check execute permissions on the starting path component */
                 struct fd f = fdget_raw(nd->dfd);
@@ -2077,16 +2081,6 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
                 fdput(f);
                 return s;
         }
-
-        nd->inode = nd->path.dentry->d_inode;
-        if (!(flags & LOOKUP_RCU))
-                return s;
-        if (likely(!read_seqcount_retry(&nd->path.dentry->d_seq, nd->seq)))
-                return s;
-        if (!(nd->flags & LOOKUP_ROOT))
-                nd->root.mnt = NULL;
-        rcu_read_unlock();
-        return ERR_PTR(-ECHILD);
 }
 
 static const char *trailing_symlink(struct nameidata *nd)
@@ -2279,6 +2273,8 @@ EXPORT_SYMBOL(vfs_path_lookup);
  *
  * Note that this routine is purely a helper for filesystem usage and should
  * not be called by generic code.
+ *
+ * The caller must hold base->i_mutex.
  */
 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
 {
@@ -2322,6 +2318,75 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
 }
 EXPORT_SYMBOL(lookup_one_len);
 
+/**
+ * lookup_one_len_unlocked - filesystem helper to lookup single pathname component
+ * @name:       pathname component to lookup
+ * @base:       base directory to lookup from
+ * @len:        maximum length @len should be interpreted to
+ *
+ * Note that this routine is purely a helper for filesystem usage and should
+ * not be called by generic code.
+ *
+ * Unlike lookup_one_len, it should be called without the parent
+ * i_mutex held, and will take the i_mutex itself if necessary.
+ */
+struct dentry *lookup_one_len_unlocked(const char *name,
+                                       struct dentry *base, int len)
+{
+        struct qstr this;
+        unsigned int c;
+        int err;
+        struct dentry *ret;
+
+        this.name = name;
+        this.len = len;
+        this.hash = full_name_hash(name, len);
+        if (!len)
+                return ERR_PTR(-EACCES);
+
+        if (unlikely(name[0] == '.')) {
+                if (len < 2 || (len == 2 && name[1] == '.'))
+                        return ERR_PTR(-EACCES);
+        }
+
+        while (len--) {
+                c = *(const unsigned char *)name++;
+                if (c == '/' || c == '\0')
+                        return ERR_PTR(-EACCES);
+        }
+        /*
+         * See if the low-level filesystem might want
+         * to use its own hash..
+         */
+        if (base->d_flags & DCACHE_OP_HASH) {
+                int err = base->d_op->d_hash(base, &this);
+                if (err < 0)
+                        return ERR_PTR(err);
+        }
+
+        err = inode_permission(base->d_inode, MAY_EXEC);
+        if (err)
+                return ERR_PTR(err);
+
+        /*
+         * __d_lookup() is used to try to get a quick answer and avoid the
+         * mutex.  A false-negative does no harm.
+         */
+        ret = __d_lookup(base, &this);
+        if (ret && unlikely(ret->d_flags & DCACHE_OP_REVALIDATE)) {
+                dput(ret);
+                ret = NULL;
+        }
+        if (ret)
+                return ret;
+
+        mutex_lock(&base->d_inode->i_mutex);
+        ret =  __lookup_hash(&this, base, 0);
+        mutex_unlock(&base->d_inode->i_mutex);
+        return ret;
+}
+EXPORT_SYMBOL(lookup_one_len_unlocked);
+
 int user_path_at_empty(int dfd, const char __user *name, unsigned flags,
                  struct path *path, int *empty)
 {
@@ -2670,10 +2735,6 @@ static int may_open(struct path *path, int acc_mode, int flag)
         struct inode *inode = dentry->d_inode;
         int error;
 
-        /* O_PATH? */
-        if (!acc_mode)
-                return 0;
-
         if (!inode)
                 return -ENOENT;
 
@@ -2695,7 +2756,7 @@ static int may_open(struct path *path, int acc_mode, int flag)
                 break;
         }
 
-        error = inode_permission(inode, acc_mode);
+        error = inode_permission(inode, MAY_OPEN | acc_mode);
         if (error)
                 return error;
 
@@ -2887,7 +2948,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
         if (*opened & FILE_CREATED) {
                 WARN_ON(!(open_flag & O_CREAT));
                 fsnotify_create(dir, dentry);
-                acc_mode = MAY_OPEN;
+                acc_mode = 0;
         }
         error = may_open(&file->f_path, acc_mode, open_flag);
         if (error)
@@ -3100,7 +3161,7 @@ retry_lookup:
                 /* Don't check for write permission, don't truncate */
                 open_flag &= ~O_TRUNC;
                 will_truncate = false;
-                acc_mode = MAY_OPEN;
+                acc_mode = 0;
                 path_to_nameidata(&path, nd);
                 goto finish_open_created;
         }
@@ -3184,10 +3245,11 @@ finish_open:
                 got_write = true;
         }
 finish_open_created:
-        error = may_open(&nd->path, acc_mode, open_flag);
-        if (error)
-                goto out;
-
+        if (likely(!(open_flag & O_PATH))) {
+                error = may_open(&nd->path, acc_mode, open_flag);
+                if (error)
+                        goto out;
+        }
         BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
         error = vfs_open(&nd->path, file, current_cred());
         if (!error) {
@@ -3274,7 +3336,7 @@ static int do_tmpfile(struct nameidata *nd, unsigned flags,
                 goto out2;
         audit_inode(nd->name, child, 0);
         /* Don't check for other permissions, the inode was just created */
-        error = may_open(&path, MAY_OPEN, op->open_flag);
+        error = may_open(&path, 0, op->open_flag);
         if (error)
                 goto out2;
         file->f_path.mnt = path.mnt;
diff --git a/fs/namespace.c b/fs/namespace.c
index 4d2c8f64b7bf..a830e1463704 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2609,18 +2609,18 @@ static long exact_copy_from_user(void *to, const void __user * from,
         return n;
 }
 
-int copy_mount_options(const void __user * data, unsigned long *where)
+void *copy_mount_options(const void __user * data)
 {
         int i;
-        unsigned long page;
         unsigned long size;
+        char *copy;
 
-        *where = 0;
         if (!data)
-                return 0;
+                return NULL;
 
-        if (!(page = __get_free_page(GFP_KERNEL)))
-                return -ENOMEM;
+        copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!copy)
+                return ERR_PTR(-ENOMEM);
 
         /* We only care that *some* data at the address the user
          * gave us is valid.  Just in case, we'll zero
@@ -2631,15 +2631,14 @@ int copy_mount_options(const void __user * data, unsigned long *where)
         if (size > PAGE_SIZE)
                 size = PAGE_SIZE;
 
-        i = size - exact_copy_from_user((void *)page, data, size);
+        i = size - exact_copy_from_user(copy, data, size);
         if (!i) {
-                free_page(page);
-                return -EFAULT;
+                kfree(copy);
+                return ERR_PTR(-EFAULT);
         }
         if (i != PAGE_SIZE)
-                memset((char *)page + i, 0, PAGE_SIZE - i);
-        *where = page;
-        return 0;
+                memset(copy + i, 0, PAGE_SIZE - i);
+        return copy;
 }
 
 char *copy_mount_string(const void __user *data)
@@ -2906,7 +2905,7 @@ SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
         int ret;
         char *kernel_type;
         char *kernel_dev;
-        unsigned long data_page;
+        void *options;
 
         kernel_type = copy_mount_string(type);
         ret = PTR_ERR(kernel_type);
@@ -2918,14 +2917,14 @@ SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
         if (IS_ERR(kernel_dev))
                 goto out_dev;
 
-        ret = copy_mount_options(data, &data_page);
-        if (ret < 0)
+        options = copy_mount_options(data);
+        ret = PTR_ERR(options);
+        if (IS_ERR(options))
                 goto out_data;
 
-        ret = do_mount(kernel_dev, dir_name, kernel_type, flags,
-                (void *) data_page);
+        ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
 
-        free_page(data_page);
+        kfree(options);
 out_data:
         kfree(kernel_dev);
 out_dev:
@@ -2949,9 +2948,9 @@ bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
         return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
 }
 
-int path_is_under(struct path *path1, struct path *path2)
+bool path_is_under(struct path *path1, struct path *path2)
 {
-        int res;
+        bool res;
         read_seqlock_excl(&mount_lock);
         res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
         read_sequnlock_excl(&mount_lock);
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 00575d776d91..2246454dec76 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -823,7 +823,7 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
                 } else
                         dchild = dget(dparent);
         } else
-                dchild = lookup_one_len(name, dparent, namlen);
+                dchild = lookup_one_len_unlocked(name, dparent, namlen);
         if (IS_ERR(dchild))
                 return rv;
         if (d_mountpoint(dchild))
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 924416f91fdd..d6ef0955a979 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2858,14 +2858,14 @@ nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd,
         __be32 nfserr;
         int ignore_crossmnt = 0;
 
-        dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
+        dentry = lookup_one_len_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
         if (IS_ERR(dentry))
                 return nfserrno(PTR_ERR(dentry));
         if (d_really_is_negative(dentry)) {
                 /*
-                 * nfsd_buffered_readdir drops the i_mutex between
-                 * readdir and calling this callback, leaving a window
-                 * where this directory entry could have gone away.
+                 * we're not holding the i_mutex here, so there's
+                 * a window where this directory entry could have gone
+                 * away.
                  */
                 dput(dentry);
                 return nfserr_noent;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 5411bf09b810..d41c149fae75 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -218,10 +218,16 @@ nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 host_err = PTR_ERR(dentry);
                 if (IS_ERR(dentry))
                         goto out_nfserr;
-                /*
-                 * check if we have crossed a mount point ...
-                 */
                 if (nfsd_mountpoint(dentry, exp)) {
+                        /*
+                         * We don't need the i_mutex after all.  It's
+                         * still possible we could open this (regular
+                         * files can be mountpoints too), but the
+                         * i_mutex is just there to prevent renames of
+                         * something that we might be about to delegate,
+                         * and a mountpoint won't be renamed:
+                         */
+                        fh_unlock(fhp);
                         if ((host_err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
                                 dput(dentry);
                                 goto out_nfserr;
@@ -1817,7 +1823,6 @@ static __be32 nfsd_buffered_readdir(struct file *file, nfsd_filldir_t func,
         offset = *offsetp;
 
         while (1) {
-                struct inode *dir_inode = file_inode(file);
                 unsigned int reclen;
 
                 cdp->err = nfserr_eof; /* will be cleared on successful read */
@@ -1836,15 +1841,6 @@ static __be32 nfsd_buffered_readdir(struct file *file, nfsd_filldir_t func,
                 if (!size)
                         break;
 
-                /*
-                 * Various filldir functions may end up calling back into
-                 * lookup_one_len() and the file system's ->lookup() method.
-                 * These expect i_mutex to be held, as it would within readdir.
-                 */
-                host_err = mutex_lock_killable(&dir_inode->i_mutex);
-                if (host_err)
-                        break;
-
                 de = (struct buffered_dirent *)buf.dirent;
                 while (size > 0) {
                         offset = de->offset;
@@ -1861,7 +1857,6 @@ static __be32 nfsd_buffered_readdir(struct file *file, nfsd_filldir_t func,
                         size -= reclen;
                         de = (struct buffered_dirent *)((char *)de + reclen);
                 }
-                mutex_unlock(&dir_inode->i_mutex);
                 if (size > 0) /* We bailed out early */
                         break;
 
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 354013ea22ec..c7343844e6b6 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -1316,13 +1316,11 @@ nilfs_mount(struct file_system_type *fs_type, int flags,
         }
 
         if (!s->s_root) {
-                char b[BDEVNAME_SIZE];
-
-                s_new = true;
+                s_new = true;
 
                 /* New superblock instance created */
                 s->s_mode = mode;
-                strlcpy(s->s_id, bdevname(sd.bdev, b), sizeof(s->s_id));
+                snprintf(s->s_id, sizeof(s->s_id), "%pg", sd.bdev);
                 sb_set_blocksize(s, block_size(sd.bdev));
 
                 err = nilfs_fill_super(s, data, flags & MS_SILENT ? 1 : 0);
diff --git a/fs/open.c b/fs/open.c
index b6f1e96a7c0b..b25b1542c530 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -887,7 +887,7 @@ EXPORT_SYMBOL(dentry_open);
 static inline int build_open_flags(int flags, umode_t mode, struct open_flags *op)
 {
         int lookup_flags = 0;
-        int acc_mode;
+        int acc_mode = ACC_MODE(flags);
 
         if (flags & (O_CREAT | __O_TMPFILE))
                 op->mode = (mode & S_IALLUGO) | S_IFREG;
@@ -909,7 +909,6 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
         if (flags & __O_TMPFILE) {
                 if ((flags & O_TMPFILE_MASK) != O_TMPFILE)
                         return -EINVAL;
-                acc_mode = MAY_OPEN | ACC_MODE(flags);
                 if (!(acc_mode & MAY_WRITE))
                         return -EINVAL;
         } else if (flags & O_PATH) {
@@ -919,8 +918,6 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
                  */
                 flags &= O_DIRECTORY | O_NOFOLLOW | O_PATH;
                 acc_mode = 0;
-        } else {
-                acc_mode = MAY_OPEN | ACC_MODE(flags);
         }
 
         op->open_flag = flags;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 55e01f88eac9..2cf5d7e37375 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2365,7 +2365,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
                                    size_t count, loff_t *ppos)
 {
         struct inode * inode = file_inode(file);
-        char *page;
+        void *page;
         ssize_t length;
         struct task_struct *task = get_proc_task(inode);
 
@@ -2380,14 +2380,11 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
         if (*ppos != 0)
                 goto out;
 
-        length = -ENOMEM;
-        page = (char*)__get_free_page(GFP_TEMPORARY);
-        if (!page)
+        page = memdup_user(buf, count);
+        if (IS_ERR(page)) {
+                length = PTR_ERR(page);
                 goto out;
-
-        length = -EFAULT;
-        if (copy_from_user(page, buf, count))
-                goto out_free;
+        }
 
         /* Guard against adverse ptrace interaction */
         length = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
@@ -2396,10 +2393,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
 
         length = security_setprocattr(task,
                                       (char*)file->f_path.dentry->d_name.name,
-                                      (void*)page, count);
+                                      page, count);
         mutex_unlock(&task->signal->cred_guard_mutex);
 out_free:
-        free_page((unsigned long) page);
+        kfree(page);
 out:
         put_task_struct(task);
 out_no_task:
diff --git a/fs/proc/fd.c b/fs/proc/fd.c
index 3c2a915c695a..56afa5ef08f2 100644
--- a/fs/proc/fd.c
+++ b/fs/proc/fd.c
@@ -258,6 +258,7 @@ static int proc_readfd_common(struct file *file, struct dir_context *ctx,
                                      name, len, instantiate, p,
                                      (void *)(unsigned long)fd))
                         goto out_fd_loop;
+                cond_resched();
                 rcu_read_lock();
         }
         rcu_read_unlock();
diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c
index 8ebd9a334085..2256e7e23e67 100644
--- a/fs/proc_namespace.c
+++ b/fs/proc_namespace.c
@@ -95,9 +95,9 @@ static int show_vfsmnt(struct seq_file *m, struct vfsmount *mnt)
 {
         struct proc_mounts *p = m->private;
         struct mount *r = real_mount(mnt);
-        int err = 0;
         struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
         struct super_block *sb = mnt_path.dentry->d_sb;
+        int err;
 
         if (sb->s_op->show_devname) {
                 err = sb->s_op->show_devname(m, mnt_path.dentry);
@@ -131,16 +131,17 @@ static int show_mountinfo(struct seq_file *m, struct vfsmount *mnt)
         struct mount *r = real_mount(mnt);
         struct super_block *sb = mnt->mnt_sb;
         struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
-        int err = 0;
+        int err;
 
         seq_printf(m, "%i %i %u:%u ", r->mnt_id, r->mnt_parent->mnt_id,
                    MAJOR(sb->s_dev), MINOR(sb->s_dev));
-        if (sb->s_op->show_path)
+        if (sb->s_op->show_path) {
                 err = sb->s_op->show_path(m, mnt->mnt_root);
-        else
+                if (err)
+                        goto out;
+        } else {
                 seq_dentry(m, mnt->mnt_root, " \t\n\\");
-        if (err)
-                goto out;
+        }
         seq_putc(m, ' ');
 
         /* mountpoints outside of chroot jail will give SEQ_SKIP on this */
@@ -168,12 +169,13 @@ static int show_mountinfo(struct seq_file *m, struct vfsmount *mnt)
         seq_puts(m, " - ");
         show_type(m, sb);
         seq_putc(m, ' ');
-        if (sb->s_op->show_devname)
+        if (sb->s_op->show_devname) {
                 err = sb->s_op->show_devname(m, mnt->mnt_root);
-        else
+                if (err)
+                        goto out;
+        } else {
                 mangle(m, r->mnt_devname ? r->mnt_devname : "none");
-        if (err)
-                goto out;
+        }
         seq_puts(m, sb->s_flags & MS_RDONLY ? " ro" : " rw");
         err = show_sb_opts(m, sb);
         if (err)
@@ -191,7 +193,7 @@ static int show_vfsstat(struct seq_file *m, struct vfsmount *mnt)
         struct mount *r = real_mount(mnt);
         struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
         struct super_block *sb = mnt_path.dentry->d_sb;
-        int err = 0;
+        int err;
 
         /* device */
         if (sb->s_op->show_devname) {
@@ -220,8 +222,7 @@ static int show_vfsstat(struct seq_file *m, struct vfsmount *mnt)
         /* optional statistics */
         if (sb->s_op->show_stats) {
                 seq_putc(m, ' ');
-                if (!err)
-                        err = sb->s_op->show_stats(m, mnt_path.dentry);
+                err = sb->s_op->show_stats(m, mnt_path.dentry);
         }
 
         seq_putc(m, '\n');
diff --git a/fs/read_write.c b/fs/read_write.c
index 2116e74a83d3..06b07d5a08fe 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -172,6 +172,45 @@ loff_t fixed_size_llseek(struct file *file, loff_t offset, int whence, loff_t si
 EXPORT_SYMBOL(fixed_size_llseek);
 
 /**
+ * no_seek_end_llseek - llseek implementation for fixed-sized devices
+ * @file:       file structure to seek on
+ * @offset:     file offset to seek to
+ * @whence:     type of seek
+ *
+ */
+loff_t no_seek_end_llseek(struct file *file, loff_t offset, int whence)
+{
+        switch (whence) {
+        case SEEK_SET: case SEEK_CUR:
+                return generic_file_llseek_size(file, offset, whence,
+                                                ~0ULL, 0);
+        default:
+                return -EINVAL;
+        }
+}
+EXPORT_SYMBOL(no_seek_end_llseek);
+
+/**
+ * no_seek_end_llseek_size - llseek implementation for fixed-sized devices
+ * @file:       file structure to seek on
+ * @offset:     file offset to seek to
+ * @whence:     type of seek
+ * @size:       maximal offset allowed
+ *
+ */
+loff_t no_seek_end_llseek_size(struct file *file, loff_t offset, int whence, loff_t size)
+{
+        switch (whence) {
+        case SEEK_SET: case SEEK_CUR:
+                return generic_file_llseek_size(file, offset, whence,
+                                                size, 0);
+        default:
+                return -EINVAL;
+        }
+}
+EXPORT_SYMBOL(no_seek_end_llseek_size);
+
+/**
  * noop_llseek - No Operation Performed llseek implementation
  * @file:       file structure to seek on
  * @offset:     file offset to seek to
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index 9d6486d416a3..44c2bdced1c8 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -618,12 +618,10 @@ static void release_buffer_page(struct buffer_head *bh)
 
 static void reiserfs_end_buffer_io_sync(struct buffer_head *bh, int uptodate)
 {
-        char b[BDEVNAME_SIZE];
-
         if (buffer_journaled(bh)) {
                 reiserfs_warning(NULL, "clm-2084",
-                                 "pinned buffer %lu:%s sent to disk",
-                                 bh->b_blocknr, bdevname(bh->b_bdev, b));
+                                 "pinned buffer %lu:%pg sent to disk",
+                                 bh->b_blocknr, bh->b_bdev);
         }
         if (uptodate)
                 set_buffer_uptodate(bh);
@@ -2387,11 +2385,10 @@ static int journal_read(struct super_block *sb)
         int replay_count = 0;
         int continue_replay = 1;
         int ret;
-        char b[BDEVNAME_SIZE];
 
         cur_dblock = SB_ONDISK_JOURNAL_1st_BLOCK(sb);
-        reiserfs_info(sb, "checking transaction log (%s)\n",
-                      bdevname(journal->j_dev_bd, b));
+        reiserfs_info(sb, "checking transaction log (%pg)\n",
+                      journal->j_dev_bd);
         start = get_seconds();
 
         /*
@@ -2651,8 +2648,8 @@ static int journal_init_dev(struct super_block *super,
 
         set_blocksize(journal->j_dev_bd, super->s_blocksize);
         reiserfs_info(super,
-                      "journal_init_dev: journal device: %s\n",
-                      bdevname(journal->j_dev_bd, b));
+                      "journal_init_dev: journal device: %pg\n",
+                      journal->j_dev_bd);
         return 0;
 }
 
@@ -2724,7 +2721,6 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
         struct reiserfs_journal_header *jh;
         struct reiserfs_journal *journal;
         struct reiserfs_journal_list *jl;
-        char b[BDEVNAME_SIZE];
         int ret;
 
         journal = SB_JOURNAL(sb) = vzalloc(sizeof(struct reiserfs_journal));
@@ -2794,10 +2790,10 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
             && (le32_to_cpu(jh->jh_journal.jp_journal_magic) !=
                 sb_jp_journal_magic(rs))) {
                 reiserfs_warning(sb, "sh-460",
-                                 "journal header magic %x (device %s) does "
+                                 "journal header magic %x (device %pg) does "
                                  "not match to magic found in super block %x",
                                  jh->jh_journal.jp_journal_magic,
-                                 bdevname(journal->j_dev_bd, b),
+                                 journal->j_dev_bd,
                                  sb_jp_journal_magic(rs));
                 brelse(bhjh);
                 goto free_and_return;
@@ -2818,10 +2814,10 @@ int journal_init(struct super_block *sb, const char *j_dev_name,
                 journal->j_max_trans_age = commit_max_age;
         }
 
-        reiserfs_info(sb, "journal params: device %s, size %u, "
+        reiserfs_info(sb, "journal params: device %pg, size %u, "
                       "journal first block %u, max trans len %u, max batch %u, "
                       "max commit age %u, max trans age %u\n",
-                      bdevname(journal->j_dev_bd, b),
+                      journal->j_dev_bd,
                       SB_ONDISK_JOURNAL_SIZE(sb),
                       SB_ONDISK_JOURNAL_1st_BLOCK(sb),
                       journal->j_trans_max,
diff --git a/fs/reiserfs/prints.c b/fs/reiserfs/prints.c
index ae1dc841db3a..4f3f928076f3 100644
--- a/fs/reiserfs/prints.c
+++ b/fs/reiserfs/prints.c
@@ -139,11 +139,9 @@ static void sprintf_block_head(char *buf, struct buffer_head *bh)
 
 static void sprintf_buffer_head(char *buf, struct buffer_head *bh)
 {
-        char b[BDEVNAME_SIZE];
-
         sprintf(buf,
-                "dev %s, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)",
-                bdevname(bh->b_bdev, b), bh->b_size,
+                "dev %pg, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)",
+                bh->b_bdev, bh->b_size,
                 (unsigned long long)bh->b_blocknr, atomic_read(&(bh->b_count)),
                 bh->b_state, bh->b_page,
                 buffer_uptodate(bh) ? "UPTODATE" : "!UPTODATE",
@@ -530,7 +528,6 @@ static int print_super_block(struct buffer_head *bh)
             (struct reiserfs_super_block *)(bh->b_data);
         int skipped, data_blocks;
         char *version;
-        char b[BDEVNAME_SIZE];
 
         if (is_reiserfs_3_5(rs)) {
                 version = "3.5";
@@ -543,7 +540,7 @@ static int print_super_block(struct buffer_head *bh)
                 return 1;
         }
 
-        printk("%s\'s super block is in block %llu\n", bdevname(bh->b_bdev, b),
+        printk("%pg\'s super block is in block %llu\n", bh->b_bdev,
                (unsigned long long)bh->b_blocknr);
         printk("Reiserfs version %s\n", version);
         printk("Block count %u\n", sb_block_count(rs));
diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
index 621b9f381fe1..fe999157dd97 100644
--- a/fs/reiserfs/procfs.c
+++ b/fs/reiserfs/procfs.c
@@ -303,11 +303,10 @@ static int show_journal(struct seq_file *m, void *unused)
         struct reiserfs_sb_info *r = REISERFS_SB(sb);
         struct reiserfs_super_block *rs = r->s_rs;
         struct journal_params *jp = &rs->s_v1.s_journal;
-        char b[BDEVNAME_SIZE];
 
         seq_printf(m,           /* on-disk fields */
                    "jp_journal_1st_block: \t%i\n"
-                   "jp_journal_dev: \t%s[%x]\n"
+                   "jp_journal_dev: \t%pg[%x]\n"
                    "jp_journal_size: \t%i\n"
                    "jp_journal_trans_max: \t%i\n"
                    "jp_journal_magic: \t%i\n"
@@ -348,7 +347,7 @@ static int show_journal(struct seq_file *m, void *unused)
                    "prepare: \t%12lu\n"
                    "prepare_retry: \t%12lu\n",
                    DJP(jp_journal_1st_block),
-                   bdevname(SB_JOURNAL(sb)->j_dev_bd, b),
+                   SB_JOURNAL(sb)->j_dev_bd,
                    DJP(jp_journal_dev),
                    DJP(jp_journal_size),
                    DJP(jp_journal_trans_max),
diff --git a/fs/select.c b/fs/select.c
index 015547330e88..79d0d4953cad 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -778,8 +778,8 @@ static inline unsigned int do_pollfd(struct pollfd *pollfd, poll_table *pwait,
         return mask;
 }
 
-static int do_poll(unsigned int nfds,  struct poll_list *list,
-                   struct poll_wqueues *wait, struct timespec *end_time)
+static int do_poll(struct poll_list *list, struct poll_wqueues *wait,
+                   struct timespec *end_time)
 {
         poll_table* pt = &wait->pt;
         ktime_t expire, *to = NULL;
@@ -908,7 +908,7 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
         }
 
         poll_initwait(&table);
-        fdcount = do_poll(nfds, head, &table, end_time);
+        fdcount = do_poll(head, &table, end_time);
         poll_freewait(&table);
 
         for (walk = head; walk; walk = walk->next) {
diff --git a/fs/splice.c b/fs/splice.c
index 4cf700d50b40..82bc0d64fc38 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -415,6 +415,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                          */
                         if (!page->mapping) {
                                 unlock_page(page);
+retry_lookup:
                                 page = find_or_create_page(mapping, index,
                                                 mapping_gfp_mask(mapping));
 
@@ -439,13 +440,10 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                         error = mapping->a_ops->readpage(in, page);
                         if (unlikely(error)) {
                                 /*
-                                 * We really should re-lookup the page here,
-                                 * but it complicates things a lot. Instead
-                                 * lets just do what we already stored, and
-                                 * we'll get it the next time we are called.
+                                 * Re-lookup the page
                                  */
                                 if (error == AOP_TRUNCATED_PAGE)
-                                        error = 0;
+                                        goto retry_lookup;
 
                                 break;
                         }
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 5056babe00df..dded920cbc8f 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -80,7 +80,6 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct squashfs_sb_info *msblk;
         struct squashfs_super_block *sblk = NULL;
-        char b[BDEVNAME_SIZE];
         struct inode *root;
         long long root_inode;
         unsigned short flags;
@@ -124,8 +123,8 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_magic = le32_to_cpu(sblk->s_magic);
         if (sb->s_magic != SQUASHFS_MAGIC) {
                 if (!silent)
-                        ERROR("Can't find a SQUASHFS superblock on %s\n",
-                                                bdevname(sb->s_bdev, b));
+                        ERROR("Can't find a SQUASHFS superblock on %pg\n",
+                                                sb->s_bdev);
                 goto failed_mount;
         }
 
@@ -178,7 +177,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
         msblk->inodes = le32_to_cpu(sblk->inodes);
         flags = le16_to_cpu(sblk->flags);
 
-        TRACE("Found valid superblock on %s\n", bdevname(sb->s_bdev, b));
+        TRACE("Found valid superblock on %pg\n", sb->s_bdev);
         TRACE("Inodes are %scompressed\n", SQUASHFS_UNCOMPRESSED_INODES(flags)
                                 ? "un" : "");
         TRACE("Data is %scompressed\n", SQUASHFS_UNCOMPRESSED_DATA(flags)
diff --git a/fs/super.c b/fs/super.c
index 954aeb80e202..cc658a20a29e 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1012,10 +1012,8 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
                 blkdev_put(bdev, mode);
                 down_write(&s->s_umount);
         } else {
-                char b[BDEVNAME_SIZE];
-
                 s->s_mode = mode;
-                strlcpy(s->s_id, bdevname(bdev, b), sizeof(s->s_id));
+                snprintf(s->s_id, sizeof(s->s_id), "%pg", bdev);
                 sb_set_blocksize(s, block_size(bdev));
                 error = fill_super(s, data, flags & MS_SILENT ? 1 : 0);
                 if (error) {
diff --git a/fs/xattr.c b/fs/xattr.c
index d7f5037a17b5..d5dd6c8b82a7 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -305,7 +305,6 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
 {
         int error;
         void *kvalue = NULL;
-        void *vvalue = NULL;    /* If non-NULL, we used vmalloc() */
         char kname[XATTR_NAME_MAX + 1];
 
         if (flags & ~(XATTR_CREATE|XATTR_REPLACE))
@@ -322,10 +321,9 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
                         return -E2BIG;
                 kvalue = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
                 if (!kvalue) {
-                        vvalue = vmalloc(size);
-                        if (!vvalue)
+                        kvalue = vmalloc(size);
+                        if (!kvalue)
                                 return -ENOMEM;
-                        kvalue = vvalue;
                 }
                 if (copy_from_user(kvalue, value, size)) {
                         error = -EFAULT;
@@ -338,10 +336,8 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
 
         error = vfs_setxattr(d, kname, kvalue, size, flags);
 out:
-        if (vvalue)
-                vfree(vvalue);
-        else
-                kfree(kvalue);
+        kvfree(kvalue);
+
         return error;
 }
 
@@ -409,7 +405,6 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
 {
         ssize_t error;
         void *kvalue = NULL;
-        void *vvalue = NULL;
         char kname[XATTR_NAME_MAX + 1];
 
         error = strncpy_from_user(kname, name, sizeof(kname));
@@ -423,10 +418,9 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
                         size = XATTR_SIZE_MAX;
                 kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
                 if (!kvalue) {
-                        vvalue = vmalloc(size);
-                        if (!vvalue)
+                        kvalue = vmalloc(size);
+                        if (!kvalue)
                                 return -ENOMEM;
-                        kvalue = vvalue;
                 }
         }
 
@@ -442,10 +436,9 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
                    than XATTR_SIZE_MAX bytes. Not possible. */
                 error = -E2BIG;
         }
-        if (vvalue)
-                vfree(vvalue);
-        else
-                kfree(kvalue);
+
+        kvfree(kvalue);
+
         return error;
 }
 
@@ -502,17 +495,15 @@ listxattr(struct dentry *d, char __user *list, size_t size)
 {
         ssize_t error;
         char *klist = NULL;
-        char *vlist = NULL;     /* If non-NULL, we used vmalloc() */
 
         if (size) {
                 if (size > XATTR_LIST_MAX)
                         size = XATTR_LIST_MAX;
                 klist = kmalloc(size, __GFP_NOWARN | GFP_KERNEL);
                 if (!klist) {
-                        vlist = vmalloc(size);
-                        if (!vlist)
+                        klist = vmalloc(size);
+                        if (!klist)
                                 return -ENOMEM;
-                        klist = vlist;
                 }
         }
 
@@ -525,10 +516,9 @@ listxattr(struct dentry *d, char __user *list, size_t size)
                    than XATTR_LIST_MAX bytes. Not possible. */
                 error = -E2BIG;
         }
-        if (vlist)
-                vfree(vlist);
-        else
-                kfree(klist);
+
+        kvfree(klist);
+
         return error;
 }
 
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 3243cdf97f33..ace91e7c713e 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1632,13 +1632,9 @@ xfs_setsize_buftarg(
         btp->bt_meta_sectormask = sectorsize - 1;
 
         if (set_blocksize(btp->bt_bdev, sectorsize)) {
-                char name[BDEVNAME_SIZE];
-
-                bdevname(btp->bt_bdev, name);
-
                 xfs_warn(btp->bt_mount,
-                        "Cannot set_blocksize to %u on device %s",
-                        sectorsize, name);
+                        "Cannot set_blocksize to %u on device %pg",
+                        sectorsize, btp->bt_bdev);
                 return -EINVAL;
         }